Commit graph

2347 commits

Author SHA1 Message Date
Josef Schlehofer
10d55f63d6
golang: Update to version 1.13.3
Fixes CVE-2019-17596

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-10-19 22:53:25 +02:00
Rosen Penev
5096509945 vala: Update to 0.46.3
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2019-10-18 15:06:57 -07:00
Rosen Penev
758865fa16
Merge pull request #10242 from jefferyto/pypi-mk
python,python3: Add pypi makefile
2019-10-18 13:26:37 -07:00
Jeffery To
add4c42191 python,python3: Add pypi makefile
This adds pypi.mk, which can be included in Python packages that
download their sources from PyPI, to auto-fill various PKG_* variables
based on the value of PYPI_NAME.

This makefile should be included after $(TOPDIR)/rules.mk but before
$(INCLUDE_DIR)/package.mk (and $(INCLUDE_DIR)/host-build.mk).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-10-19 00:16:26 +08:00
Michael Heimpold
b8c22fc1ec php7-mod-xmlreader: add conditional dependency to php7-mod-dom (fixes #10201)
PHP7 fails to load xmlreader.so (php7-mod-xmlreader) module without
dom.so (php7-mod-dom) module loaded:

-snip-
PHP Warning:  PHP Startup: Unable to load dynamic library 'xmlreader.so'
 (tried: /usr/lib/php/xmlreader.so (Error relocating /usr/lib/php/xmlreader.so:
 dom_node_class_entry: symbol not found), /usr/lib/php/xmlreader.so.so (Error
 loading shared library /usr/lib/php/xmlreader.so.so: No such file or
 directory)) in Unknown on line 0
^C
-snap-

However, this dependency only exists when during build also php7-mod-dom
is selected.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2019-10-16 00:04:24 +02:00
Jeffery To
5848f67e41 python-pyasn1-modules: Update to 0.2.7
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-10-16 02:12:51 +08:00
Rosen Penev
2dc860e24b
Merge pull request #10181 from commodo/python-simple-json-drop-tests
python[3]-simplejson: drop tests from simplejson package
2019-10-14 01:03:18 -07:00
Rosen Penev
7ec627cdc9
Merge pull request #10227 from flyn-org/luasec
luasec: update to 0.8.2
2019-10-14 00:56:34 -07:00
Rosen Penev
ffafefba87
Merge pull request #10228 from flyn-org/php7-pecl-mcrypt
php7-pecl-mcrypt: update to 1.0.3
2019-10-13 20:09:12 -07:00
W. Michael Petullo
007e74146b php7-pecl-mcrypt: update to 1.0.3
Signed-off-by: W. Michael Petullo <mike@flyn.org>
2019-10-13 16:49:05 -04:00
W. Michael Petullo
b9e7e3c98e luasec: update to 0.8.2
Signed-off-by: W. Michael Petullo <mike@flyn.org>
2019-10-13 16:43:02 -04:00
Rosen Penev
91c79bad56
Merge pull request #10209 from etactica/pulls/luaposix-docs
luaposix: disable documentation build
2019-10-13 11:42:30 -07:00
Rosen Penev
3365165bd6
Merge pull request #10211 from BKPepe/sentrysdk
python-sentry-sdk: Update to version 0.12.3
2019-10-12 21:17:41 -07:00
Josef Schlehofer
fd9ebe3d70
python-sentry-sdk: Update to version 0.12.3
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-10-12 23:55:36 +02:00
Jeffery To
53e1692ae9 treewide: Use default PKG_BUILD_DIR when possible
This removes lines that set PKG_BUILD_DIR when the set value is no
different from the default value.

Specifically, the line is removed if the assigned value is:

* $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)

  The default PKG_BUILD_DIR was updated[1] to incorporate BUILD_VARIANT
  if it is set, so now this is identical to the default value.

* $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_SOURCE_SUBDIR)

  if PKG_SOURCE_SUBDIR is set to $(PKG_NAME)-$(PKG_VERSION), making it
  the same as the previous case

* $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

  This is the same as the default PKG_BUILD_DIR when there is no
  BUILD_VARIANT.

* $(BUILD_DIR)/[name]-$(PKG_VERSION)

  where [name] is a string that is identical to PKG_NAME

[1]: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=e545fac8d968864a965edb9e50c6f90940b0a6c9

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-10-13 02:01:34 +08:00
Karl Palsson
b683fad607 luaposix: disable documentation build
Lost when luaposix converted their upstream build system.
Required to prevent the build from attempting to invoke "ldoc" on the
host and also simply to speed it up.

Signed-off-by: Karl Palsson <karlp@tweak.net.au>
2019-10-12 13:52:20 +00:00
Rosen Penev
96f44c5c33
Merge pull request #10182 from jefferyto/python-attrs-19.2.0
python-attrs: Update to 19.2.0
2019-10-09 12:50:07 -07:00
Rosen Penev
25d0c17dfb
Merge pull request #10187 from commodo/python-asn1crypto-update
python-asn1crypto: bump to version 1.0.1
2019-10-09 12:43:20 -07:00
Alexandru Ardelean
03f625047d python-asn1crypto: bump to version 1.0.1
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-10-09 13:23:28 +03:00
Alexandru Ardelean
929df778cc python-pillow: bump to version 6.2.0
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-10-09 11:53:46 +03:00
Jeffery To
d62dc51634 python-attrs: Update to 19.2.0
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-10-09 05:18:44 +08:00
Alexandru Ardelean
2f19a94d65 python[3]-simplejson: drop tests from simplejson package
These tests take-up a bit of space. And they aren't typically needed.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-10-08 16:53:36 +03:00
Jeffery To
a3be5cfa92 python,python3: Fix CVE-2019-16056, CVE-2019-16935
These patches address issues:
CVE-2019-16056: email.utils.parseaddr mistakenly parse an email
CVE-2019-16935: A reflected XSS in python/Lib/DocXMLRPCServer.py (for
Python 2.7)

CVE-2019-16935 was fixed for python3 in #10109

Links to Python issues:
https://bugs.python.org/issue34155
https://bugs.python.org/issue38243

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-10-04 23:54:46 +08:00
Jeffery To
47d6d8e514 python-simplejson: Fix python[3]-decimal dependency
simplejson depends on the decimal module[1][2]. This adds
python[3]-decimal to the package's DEPENDS.

[1]: https://github.com/simplejson/simplejson/blob/v3.16.0/simplejson/__init__.py#L110
[2]: https://github.com/simplejson/simplejson/blob/v3.16.0/simplejson/encoder.py#L7

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-10-04 22:40:25 +08:00
Michael Heimpold
f14a76253a
Merge pull request #10126 from stefaang/php7-mod-gd
php7-mod-gd: enable libwebp
php7: bump to 7.2.23
2019-10-03 14:32:46 +02:00
Stefaan Ghysels
dacda44755 php7: bump to 7.2.23
Signed-off-by: Stefaan Ghysels <stefaang@gmail.com>
2019-10-03 13:44:23 +02:00
Stefaan Ghysels
84a449440a php7-mod-gd: enable libwebp
Signed-off-by: Stefaan Ghysels <stefaang@gmail.com>
2019-10-03 13:42:38 +02:00
Rosen Penev
d2df36bbb0
vala: Update to 0.46.2
Removed inactive maintainer.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2019-10-02 15:15:00 -07:00
Rosen Penev
15dfcc3611
Merge pull request #10121 from BKPepe/werkzeug
Werkzeug: Update to version 0.16.0
2019-10-02 12:37:06 -07:00
Rosen Penev
0d3d4ca894
Merge pull request #10122 from BKPepe/flask
Flask: Update to version 1.1.1
2019-10-02 12:36:11 -07:00
Josef Schlehofer
1ccf2377fc
python3-maxminddb: Update to version 1.5.1
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-10-01 00:38:47 +02:00
Josef Schlehofer
19e12971b8
Flask: Update to version 1.1.1
- Change TITLE and URL to better one
- Add source package

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-10-01 00:21:42 +02:00
Josef Schlehofer
267796c316
Werkzeug: Update to version 0.16.0
- Remove PKG_BUILD_DEPENDS as it is no longer necessary.
- The Python3 is already included in DEPENDS.
- Remove PKG_BUILD_DIR and PKG_UNPACK was for dual Python version.
- Change TITLE and description
- Add source package

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-10-01 00:15:35 +02:00
Josef Schlehofer
144c8da84a
python-pyrsistent: Update to version 0.15.4
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-09-30 21:22:35 +02:00
Josef Schlehofer
80def9e653
python3: backport three security patches
Fixes: CVE-2019-16935

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-09-29 23:18:29 +02:00
Josef Schlehofer
65b7bd6cc0
golang: Update to version 1.13.1
Fixes CVE-2019-16276

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-09-29 00:53:05 +02:00
Rosen Penev
014ebb2f16
Merge pull request #10083 from BKPepe/sentrysdk
python-sentry-sdk: Update to version 0.12.2
2019-09-27 12:09:09 -07:00
Rosen Penev
b72cbb7e2c
Merge pull request #10092 from ysc3839/pycryptodome
python-cryptodome: update to 3.9.0
2019-09-27 12:07:08 -07:00
Rosen Penev
ccd2b767d9
jamvm: Don't compile on ARM64
Not supported.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2019-09-27 10:09:44 -07:00
Alexander Ryzhov
7910715d86
perl-www-curl: curl 7.66.0 compatibility
Signed-off-by: Alexander Ryzhov <github@ryzhov-al.ru>
2019-09-27 15:02:29 +03:00
Richard Yu
ad9fe1b60b
python-cryptodome: update to 3.9.0
Signed-off-by: Richard Yu <yurichard3839@gmail.com>
2019-09-27 17:05:44 +08:00
Josef Schlehofer
ff106ae376
python-sentry-sdk: Update to version 0.12.2
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-09-26 18:21:43 +02:00
Josef Schlehofer
da51877e7f
python-urllib3: Update to version 1.25.6
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-09-26 11:45:40 +02:00
Jan Pavlinec
ceadbcbb64
treewide: add PKG_CPE_ID for cvescanner
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2019-09-24 13:51:22 +02:00
Alexandru Ardelean
5f9ea76e7a gunicorn: convert to Python packaging format + add Python3 variant
And splitting the gunicorn[3] binary/executable away from the
python[3]-gunicorn libraries. This was inspired from Debian packaging.

The gunicorn[3] binaries require the new `python[3]-pkg-resources`
libraries to run, which add ~1.1 MB on the [ram]disk when uncompressed.

For the Python2 variant, the `_gaiohttp.py` is dropped as it fails to
compile, so it would likely be unusable anyway:
```
  File "/usr/lib/python2.7/site-packages/gunicorn/workers/_gaiohttp.py", line 84
    yield from self.wsgi.close()
             ^
  SyntaxError: invalid syntax

```

People around the web recommend this as well:
 https://stackoverflow.com/questions/25611140/syntax-error-installing-gunicorn
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=803170
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=803202

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-09-20 14:11:08 +03:00
Alexandru Ardelean
721642908c python,python3: add Py[3]Shebang functions & move outside of script
Some packages just install some Python binaries, that may need their
shebang fixed.
This change adds some utilities to help with that and try to centralize the
sed rules a bit.

It also removes the logic from the `python-package-install.sh` into the
`python-package[3].mk` files. This does 2 things:
1. It minimizes the need for the shell script to know the Python
   version 2/3
2. Makes the logic re-usable in packages; especially if the install rules
   differ a bit

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-09-20 14:10:00 +03:00
Alexandru Ardelean
ed0e77f3c3 python,python3: split python[3]-pkg-resources from setuptools
This package is required by other packages to run some binaries via
`load_entry_point`.

So, this splits this package away from setuptools.
setuptools is pretty big, akd pkg-resources is also big, but not as big.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-09-20 13:42:40 +03:00
Alexandru Ardelean
b104c56e2b python: change condition check for legacy opt for Python3
As I remember this worked.
But since `set -e` is set, I am a bit paranoid about it. In the sense that
it may fail if `ver` != 3.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-09-20 13:42:21 +03:00
Eneas U de Queiroz
acf7c540ca
python-certifi: bump to 2019.9.11
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
2019-09-19 14:30:35 -03:00
Rosen Penev
64a02079da
django: Update to 1.11.24
Fixes a whole bunchs of CVEs:

CVE-2019-3498
CVE-2019-6975
CVE-2019-12308
CVE-2019-12781
CVE-2019-14232
CVE-2019-14233
CVE-2019-14234
CVE-2019-14235

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2019-09-18 14:40:47 -07:00